Threats tagged 'ghsa-7ggx-x32v-fc5c'

ArcadeDB versions from 21.12.1 up to but not including 26.10.2 have an authorization bypass vulnerability. This flaw allows users with only readRecord privileges to replace the shared GraphQL schema via the read-only query endpoint. By sending a crafted GraphQL type definition with a malicious @sql directive to the /api/v1/query/{database} endpoint, attackers can alter query results returned to other users, including administrators.